@marcusrbrown/infra 0.27.0 → 0.27.1

package/dist/cli.js

@@ -6950,7 +6950,7 @@ import { goke } from "goke";
 // package.json
 var package_default = {
   name: "@marcusrbrown/infra",
-  version: "0.27.0",
+  version: "0.27.1",
   description: "Infrastructure management CLI \u2014 deploy automation, health checks, and MCP bridge",
   keywords: [
     "infra",
@@ -12720,7 +12720,7 @@ async function restoreGatewayCa(opts, spawn = defaultSpawn4) {
   }
 }
 function registerGatewayRestore(cli) {
-  cli.command("gateway restore", "Restore the mitmproxy CA certificate and private key from a local tarball into the gateway Docker volume. Restarts mitmproxy and gateway services after restore and confirms byte-equal content before reporting success.").option("--input <file>", z25.string().describe("Path to the tarball produced by `gateway backup --include-ca`. Required.")).option("--include-ca", z25.boolean().default(true).describe("Restore the mitmproxy CA certificate and private key. Currently the only supported restore target.")).example("# Restore CA from a backup tarball").example("infra gateway restore --input apps/gateway/.local/mitmproxy-ca.tar").example("# Restore CA from a custom path").example("infra gateway restore --input /secure/backup/mitmproxy-ca.tar --include-ca").action(async (options) => {
+  cli.command("gateway restore", "Restore the mitmproxy CA certificate and private key from a local tarball into the gateway Docker volume. Restarts mitmproxy and gateway services after restore and confirms byte-equal content before reporting success.").option("--input <file>", z25.string().describe("Path to the tarball produced by `gateway backup --include-ca`.")).required().option("--include-ca", z25.boolean().default(true).describe("Restore the mitmproxy CA certificate and private key. Currently the only supported restore target.")).example("# Restore CA from a backup tarball").example("infra gateway restore --input apps/gateway/.local/mitmproxy-ca.tar").example("# Restore CA from a custom path").example("infra gateway restore --input /secure/backup/mitmproxy-ca.tar --include-ca").action(async (options) => {
     const hostEnvKey = "GATEWAY_HOST";
     const host = process.env[hostEnvKey];
     if (!host) {
@@ -13577,7 +13577,7 @@ function registerMcp(cli) {
 import { z as z43 } from "zod";
 
 // src/status/deploy-state.ts
-import { z as z30 } from "zod";
+import { z as z31 } from "zod";
 
 // src/status/github-api.ts
 var GITHUB_API_ORIGIN = "https://api.github.com";
@@ -13659,51 +13659,78 @@ async function githubGetLogText(fetchFn, token, path) {
   }
 }
 
-// src/status/observation.ts
+// ../shared/status/history-schema.ts
 import { z as z29 } from "zod";
-var STATUS_SCHEMA_VERSION = 1;
-var OBSERVATION_KINDS = ["reachability", "container-health", "deploy-state", "end-to-end", "resource"];
-var OBSERVATION_SOURCES = ["http", "ssh", "github-api", "monitor", "config"];
+var HISTORY_SCHEMA_VERSION = 1;
+var HISTORY_WINDOW_DAYS = 90;
+var HISTORY_WINDOW_MS = HISTORY_WINDOW_DAYS * 24 * 60 * 60000;
 var APP_IDS = ["keeweb", "cliproxy", "gateway", "umami", "dashboard", "vpn", "broker"];
+var OBSERVATION_KINDS = ["reachability", "container-health", "deploy-state", "end-to-end", "resource"];
+var MAX_OBSERVATIONS_PER_SAMPLE = 32;
 var isoTimestampSchema = z29.iso.datetime();
-var observationDetailSchema = z29.strictObject({
+var sampleDetailSchema = z29.strictObject({
   statusCode: z29.number().int().min(100).max(599).optional(),
-  durationMs: z29.number().int().min(0).max(600000).optional(),
   contractVersion: z29.string().min(1).max(64).optional(),
   since: isoTimestampSchema.optional(),
   probeAt: isoTimestampSchema.optional(),
   reason: z29.string().max(32).regex(/^[a-z][a-z0-9_-]*$/).optional()
 });
+var resultCodeSchema = z29.enum(["p", "f", "u", "n"]);
+var observationIdSchema = z29.string().max(64).regex(/^[a-z][a-z0-9-]*$/);
+var historySampleSchema = z29.strictObject({
+  t: isoTimestampSchema,
+  run: z29.string().regex(/^(?:\d{1,20}|local(?:-\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z)?)$/),
+  att: z29.number().int().min(1).max(1e4),
+  r: z29.record(observationIdSchema, resultCodeSchema),
+  d: z29.record(observationIdSchema, sampleDetailSchema).optional()
+}).refine((sample) => {
+  const count = Object.keys(sample.r).length;
+  return count >= 1 && count <= MAX_OBSERVATIONS_PER_SAMPLE;
+}, "r must hold 1 to 32 results").refine((sample) => Object.keys(sample.d ?? {}).every((id) => (id in sample.r)), "d may only describe ids present in r");
+var historyMetaSchema = z29.strictObject({
+  schemaVersion: z29.literal(HISTORY_SCHEMA_VERSION),
+  lastSampleAt: isoTimestampSchema
+});
+var historyAppFileSchema = z29.array(historySampleSchema);
+
+// src/status/observation.ts
+import { z as z30 } from "zod";
+var STATUS_SCHEMA_VERSION = 1;
+var OBSERVATION_SOURCES = ["http", "ssh", "github-api", "monitor", "config"];
+var isoTimestampSchema2 = z30.iso.datetime();
+var observationDetailSchema = sampleDetailSchema.extend({
+  durationMs: z30.number().int().min(0).max(600000).optional()
+});
 var observationBaseShape = {
-  id: z29.string().max(64).regex(/^[a-z][a-z0-9-]*$/),
-  kind: z29.enum(OBSERVATION_KINDS),
-  source: z29.enum(OBSERVATION_SOURCES),
+  id: z30.string().max(64).regex(/^[a-z][a-z0-9-]*$/),
+  kind: z30.enum(OBSERVATION_KINDS),
+  source: z30.enum(OBSERVATION_SOURCES),
   detail: observationDetailSchema.optional()
 };
-var observationSchema = z29.discriminatedUnion("result", [
-  z29.strictObject({
+var observationSchema = z30.discriminatedUnion("result", [
+  z30.strictObject({
     ...observationBaseShape,
-    result: z29.enum(["pass", "fail", "unknown"]),
-    observedAt: isoTimestampSchema
+    result: z30.enum(["pass", "fail", "unknown"]),
+    observedAt: isoTimestampSchema2
   }),
-  z29.strictObject({
+  z30.strictObject({
     ...observationBaseShape,
-    result: z29.literal("not_measured"),
-    observedAt: z29.null()
+    result: z30.literal("not_measured"),
+    observedAt: z30.null()
   })
 ]);
-var jsonValueSchema = z29.lazy(() => z29.union([
-  z29.string(),
-  z29.number(),
-  z29.boolean(),
-  z29.null(),
-  z29.array(jsonValueSchema),
-  z29.record(z29.string(), jsonValueSchema)
+var jsonValueSchema = z30.lazy(() => z30.union([
+  z30.string(),
+  z30.number(),
+  z30.boolean(),
+  z30.null(),
+  z30.array(jsonValueSchema),
+  z30.record(z30.string(), jsonValueSchema)
 ]));
-var appStatusSchema = z29.strictObject({
-  app: z29.enum(APP_IDS),
-  observations: z29.array(observationSchema),
-  facts: z29.record(z29.string().max(64), jsonValueSchema)
+var appStatusSchema = z30.strictObject({
+  app: z30.enum(APP_IDS),
+  observations: z30.array(observationSchema),
+  facts: z30.record(z30.string().max(64), jsonValueSchema)
 }).check((ctx) => {
   const seen = new Set;
   for (const [index, observation] of ctx.value.observations.entries()) {
@@ -13718,10 +13745,10 @@ var appStatusSchema = z29.strictObject({
     seen.add(observation.id);
   }
 });
-var statusEnvelopeSchema = z29.strictObject({
-  schemaVersion: z29.literal(STATUS_SCHEMA_VERSION),
-  generatedAt: isoTimestampSchema,
-  apps: z29.array(appStatusSchema)
+var statusEnvelopeSchema = z30.strictObject({
+  schemaVersion: z30.literal(STATUS_SCHEMA_VERSION),
+  generatedAt: isoTimestampSchema2,
+  apps: z30.array(appStatusSchema)
 }).check((ctx) => {
   const seen = new Set;
   for (const [index, entry] of ctx.value.apps.entries()) {
@@ -13743,8 +13770,8 @@ var DEPLOY_STATE_REF = "main";
 var DEPLOY_STATE_CALLS_PER_APP = 2;
 var DEPLOY_STATE_CALL_BUDGET = APP_IDS.length * DEPLOY_STATE_CALLS_PER_APP;
 var SPEC = { id: DEPLOY_STATE_ID, kind: "deploy-state", source: "github-api" };
-var deploymentListSchema = z30.array(z30.object({ id: z30.number().int().positive(), ref: z30.string() }));
-var statusListSchema = z30.array(z30.object({ state: z30.string().min(1).max(32), created_at: z30.iso.datetime() }));
+var deploymentListSchema = z31.array(z31.object({ id: z31.number().int().positive(), ref: z31.string() }));
+var statusListSchema = z31.array(z31.object({ state: z31.string().min(1).max(32), created_at: z31.iso.datetime() }));
 function mapDeploymentState(state) {
   switch (state) {
     case "success":
@@ -13801,7 +13828,7 @@ async function readDeployStates(options) {
 }
 
 // src/status/monitor-state.ts
-import { z as z31 } from "zod";
+import { z as z32 } from "zod";
 var MONITOR_OBSERVATION_ID = "provider-route";
 var MONITOR_WORKFLOW_FILE = "cliproxy-auth-monitor.yaml";
 var PROBE_LINE_PREFIX = "CLIProxy auth monitor probe:";
@@ -13818,16 +13845,16 @@ var PROBE_REASON_STATE = {
   timeout: "unknown",
   network: "unknown"
 };
-var runsSchema = z31.object({
-  workflow_runs: z31.array(z31.object({
-    id: z31.number().int().positive(),
-    event: z31.string(),
-    head_branch: z31.string().nullable(),
-    status: z31.string()
+var runsSchema = z32.object({
+  workflow_runs: z32.array(z32.object({
+    id: z32.number().int().positive(),
+    event: z32.string(),
+    head_branch: z32.string().nullable(),
+    status: z32.string()
   }))
 });
-var jobsSchema = z31.object({ jobs: z31.array(z31.object({ id: z31.number().int().positive() })) });
-var isoSchema = z31.iso.datetime();
+var jobsSchema = z32.object({ jobs: z32.array(z32.object({ id: z32.number().int().positive() })) });
+var isoSchema = z32.iso.datetime();
 var RUNNER_PREFIX = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z /;
 var PROBE_LINE = /^CLIProxy auth monitor probe: probe=([a-z]+) reason=([a-z0-9-]+) at (\S+)$/;
 function isReason(value) {
@@ -13938,27 +13965,27 @@ function githubObservationsFor(app, reads, now) {
 
 // src/commands/status-history-locate.ts
 import { appendFile } from "fs/promises";
-import { z as z32 } from "zod";
+import { z as z33 } from "zod";
 var HISTORY_ARTIFACT_NAME = "status-history";
 var SNAPSHOT_WORKFLOW_PATH = ".github/workflows/status-snapshot.yaml";
 var HISTORY_LOCATE_RUN_CHECK_BUDGET = 5;
 var LIST_PAGE_SIZE = 100;
 var WRITER_EVENTS = new Set(["schedule", "workflow_dispatch"]);
 var REPOSITORY_PATTERN = /^[\w.-]+\/[\w.-]+$/;
-var artifactsSchema = z32.object({
-  total_count: z32.number().int().nonnegative(),
-  artifacts: z32.array(z32.object({
-    name: z32.string(),
-    expired: z32.boolean(),
-    created_at: z32.iso.datetime({ offset: true }),
-    workflow_run: z32.object({ id: z32.number().int().positive(), head_branch: z32.string().nullable() }).nullable()
+var artifactsSchema = z33.object({
+  total_count: z33.number().int().nonnegative(),
+  artifacts: z33.array(z33.object({
+    name: z33.string(),
+    expired: z33.boolean(),
+    created_at: z33.iso.datetime({ offset: true }),
+    workflow_run: z33.object({ id: z33.number().int().positive(), head_branch: z33.string().nullable() }).nullable()
   }))
 });
-var runSchema = z32.object({
-  id: z32.number().int().positive(),
-  event: z32.string(),
-  head_branch: z32.string().nullable(),
-  path: z32.string()
+var runSchema = z33.object({
+  id: z33.number().int().positive(),
+  event: z33.string(),
+  head_branch: z33.string().nullable(),
+  path: z33.string()
 });
 async function locateHistory(fetchFn, token, repository) {
   const listed = await githubGetJson(fetchFn, token, `/repos/${repository}/actions/artifacts?name=${HISTORY_ARTIFACT_NAME}&per_page=${LIST_PAGE_SIZE}`, artifactsSchema);
@@ -14023,13 +14050,8 @@ import { z as z34 } from "zod";
 import { randomUUID } from "crypto";
 import { mkdir, readdir, readFile, rename, rm, stat, writeFile } from "fs/promises";
 import { join as join8 } from "path";
-import { z as z33 } from "zod";
-var HISTORY_SCHEMA_VERSION = 1;
-var HISTORY_WINDOW_DAYS = 90;
-var HISTORY_WINDOW_MS = HISTORY_WINDOW_DAYS * 24 * 60 * 60000;
 var HISTORY_MAX_BYTES = 10 * 1024 * 1024;
 var MAX_FUTURE_SKEW_MS2 = 5 * 60000;
-var MAX_OBSERVATIONS_PER_SAMPLE = 32;
 var MESSAGES = {
   "missing-history": "history not found; pass --bootstrap to create it",
   "history-exists": "history already exists; refusing to bootstrap over it",
@@ -14057,31 +14079,7 @@ class HistoryError extends Error {
   }
 }
 var RESULT_CODES = { pass: "p", fail: "f", unknown: "u", not_measured: "n" };
-var resultCodeSchema = z33.enum(["p", "f", "u", "n"]);
-var observationIdSchema = z33.string().max(64).regex(/^[a-z][a-z0-9-]*$/);
 var SAMPLE_DETAIL_KEYS = ["statusCode", "reason", "contractVersion", "since", "probeAt"];
-var sampleDetailSchema = observationDetailSchema.pick({
-  statusCode: true,
-  reason: true,
-  contractVersion: true,
-  since: true,
-  probeAt: true
-});
-var historySampleSchema = z33.strictObject({
-  t: z33.iso.datetime(),
-  run: z33.string().regex(/^(?:\d{1,20}|local(?:-\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z)?)$/),
-  att: z33.number().int().min(1).max(1e4),
-  r: z33.record(observationIdSchema, resultCodeSchema),
-  d: z33.record(observationIdSchema, sampleDetailSchema).optional()
-}).refine((sample) => {
-  const count = Object.keys(sample.r).length;
-  return count >= 1 && count <= MAX_OBSERVATIONS_PER_SAMPLE;
-}, "r must hold 1 to 32 results").refine((sample) => Object.keys(sample.d ?? {}).every((id) => (id in sample.r)), "d may only describe ids present in r");
-var historyMetaSchema = z33.strictObject({
-  schemaVersion: z33.literal(HISTORY_SCHEMA_VERSION),
-  lastSampleAt: z33.iso.datetime()
-});
-var historyAppFileSchema = z33.array(historySampleSchema);
 function recordByApp(build) {
   return {
     keeweb: build("keeweb"),
@@ -14374,7 +14372,7 @@ async function statusSnapshotAction(options, ctx, deps, env = process.env) {
   }
 }
 function registerStatusSnapshot(cli, deps) {
-  cli.command("status snapshot", "Take one public-safe status sample and merge it into the 90-day history directory. Runs only the public HTTPS probes, the GitHub Deployments reader and the auth monitor reader (GITHUB_TOKEN or GH_TOKEN, read-only); it uses no SSH and no deploy secrets. Stages every file as a temp file before renaming any into place; any invariant violation exits non-zero and writes nothing. Prints counts only. Exits 0 once the snapshot is written, even when observations are fail or unknown, because those are data. CLI-only: not exposed over MCP.").option("--history <dir>", z34.string().min(1).describe("History directory holding meta.json and apps/<app>.json. It must already contain a valid history unless --bootstrap is given.")).option("--bootstrap", z34.boolean().describe("Create the history and its first sample. Fails if meta.json or any app file already exists; without this flag a missing history fails.")).option("--now [iso]", z34.string().describe("UTC ISO timestamp (for example 2026-11-01T12:00:00Z) to use as the sample time and the 90-day trim reference instead of the clock. Intended for tests and replays.")).example("# Create the first history sample in an empty directory").example("infra status snapshot --history ./status-history --bootstrap").example("# Append a sample to an existing history").example("infra status snapshot --history ./status-history").action((options, ctx) => statusSnapshotAction(options, ctx, deps));
+  cli.command("status snapshot", "Take one public-safe status sample and merge it into the 90-day history directory. Runs only the public HTTPS probes, the GitHub Deployments reader and the auth monitor reader (GITHUB_TOKEN or GH_TOKEN, read-only); it uses no SSH and no deploy secrets. Stages every file as a temp file before renaming any into place; any invariant violation exits non-zero and writes nothing. Prints counts only. Exits 0 once the snapshot is written, even when observations are fail or unknown, because those are data. CLI-only: not exposed over MCP.").option("--history <dir>", z34.string().min(1).describe("History directory holding meta.json and apps/<app>.json. It must already contain a valid history unless --bootstrap is given.")).required().option("--bootstrap", z34.boolean().describe("Create the history and its first sample. Fails if meta.json or any app file already exists; without this flag a missing history fails.")).option("--now [iso]", z34.string().describe("UTC ISO timestamp (for example 2026-11-01T12:00:00Z) to use as the sample time and the 90-day trim reference instead of the clock. Intended for tests and replays.")).example("# Create the first history sample in an empty directory").example("infra status snapshot --history ./status-history --bootstrap").example("# Append a sample to an existing history").example("infra status snapshot --history ./status-history").action((options, ctx) => statusSnapshotAction(options, ctx, deps));
 }
 
 // src/commands/umami/deploy.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",